COPY_DSCP(3)

📦 version 26.03, in nixos 26.05, nixpkgs unstable

💅 rte_securi..._sa_options(3) — Library Functions Manual 💅

okay so bestie, welcome to the group chat where we talk about rte_security_ipsec_sa_options, and honestly? this page is a whole vibe. it's the option-flags struct for an IPsec Security Association in DPDK, and every single bit field matters. let's get into it 🫶

✨ NAME ✨

rte_security_ipsec_sa_options — yes that's the name, that's the whole name, no extra lore needed 💖

🌸 SYNOPSIS 🌸

include it like this, exactly like this, no cap:

#include <rte_security.h>

🎀 Data Fields

here's the full squad of bits, in order, bestie — every one of them a uint32_t:

uint32_t esn: 1
uint32_t udp_encap: 1
uint32_t copy_dscp: 1
uint32_t copy_flabel: 1
uint32_t copy_df: 1
uint32_t dec_ttl: 1
uint32_t ecn: 1
uint32_t stats: 1
uint32_t iv_gen_disable: 1
uint32_t tunnel_hdr_verify: 2
uint32_t udp_ports_verify: 1
uint32_t ip_csum_enable: 1
uint32_t l4_csum_enable: 1
uint32_t ip_reassembly_en: 1
uint32_t ingress_oop: 1

👀 notice tunnel_hdr_verify gets 2 bits, everyone else gets 1. main character energy fr fr.

🦋 DETAILED DESCRIPTION 🦋

these are the IPsec Security Association option flags. that's the whole concept, and it's iconic.

Defined at line 111 of file rte_security.h. remember that, there might be a pop quiz 🍓

👑 FIELD DOCUMENTATION 👑

💜 uint32_t esn

Extended Sequence Numbers (ESN) — the way that this just decides how big your sequence numbers are 😭

  • 1: Use extended (64 bit) sequence numbers
  • 0: Use normal sequence numbers
Defined at line 117 of file rte_security.h.

💜 uint32_t udp_encap

UDP encapsulation — the NAT-traversal cheat code ✨

  • 1: Do UDP encapsulation/decapsulation so that IPSEC packets can traverse through NAT boxes.
  • 0: No UDP encapsulation
Defined at line 125 of file rte_security.h.

💜 uint32_t copy_dscp

Copy DSCP bits — literally just carrying the vibes of your QoS marking from one header to the other 🎀

  • 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to the outer IP header in encapsulation, and vice versa in decapsulation.
  • 0: Do not change DSCP field.
Defined at line 134 of file rte_security.h.

💜 uint32_t copy_flabel

Copy IPv6 Flow Label — same energy, but for the IPv6 flow label 🌈

  • 1: Copy IPv6 flow label from inner IPv6 header to the outer IPv6 header.
  • 0: Outer header is not modified.
Defined at line 142 of file rte_security.h.

💜 uint32_t copy_df

Copy IPv4 Don't Fragment bit — the DF bit, do not come for it 💅

  • 1: Copy the DF bit from the inner IPv4 header to the outer IPv4 header.
  • 0: Outer header is not modified.
Defined at line 150 of file rte_security.h.

💜 uint32_t dec_ttl

Decrement inner packet Time To Live (TTL) field — the little countdown nobody wants to think about 💀

  • 1: In tunnel mode, decrement inner packet IPv4 TTL or IPv6 Hop Limit after tunnel decapsulation, or before tunnel encapsulation.
  • 0: Inner packet is not modified.
Defined at line 159 of file rte_security.h.

💜 uint32_t ecn

Explicit Congestion Notification (ECN) — congestion control but make it a field 🫶

  • 1: In tunnel mode, enable outer header ECN Field copied from inner header in tunnel encapsulation, or inner header ECN field construction in decapsulation.
  • 0: Inner/outer header are not modified.
Defined at line 168 of file rte_security.h.

💜 uint32_t stats

Security statistics — numbers! we love numbers! 📊

  • 1: Enable per session security statistics collection for this SA, if supported by the driver.
  • 0: Disable per session security statistics collection for this SA.
Defined at line 176 of file rte_security.h.

💜 uint32_t iv_gen_disable

Disable IV generation in PMD — the flip-flop flag, pay attention to the polarity bestie, 1 means disable 🙈

  • 1: Disable IV generation in PMD. When disabled, IV provided in rte_crypto_op will be used by the PMD.
  • 0: Enable IV generation in PMD. When enabled, PMD generated random value would be used and application is not required to provide IV.
Note: For inline cases, IV generation would always need to be handled by the PMD.
Defined at line 190 of file rte_security.h.

💜 uint32_t tunnel_hdr_verify

Verify tunnel header in inbound — two bits, two whole options 🔥

  • RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR: Verify destination IP address.
  • RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR: Verify both source and destination IP addresses.
Defined at line 199 of file rte_security.h.

💜 uint32_t udp_ports_verify

Verify UDP encapsulation ports in inbound — port matching, but just the inbound side ✨

  • 1: Match UDP source and destination ports
  • 0: Do not match UDP ports
Defined at line 206 of file rte_security.h.

💜 uint32_t ip_csum_enable

Compute/verify inner packet IPv4 header checksum in tunnel mode — the checksum gatekeeper 🌸

  • 1: For outbound, compute inner packet IPv4 header checksum before tunnel encapsulation and for inbound, verify after tunnel decapsulation.
  • 0: Inner packet IP header checksum is not computed/verified.

The checksum verification status would be set in mbuf using RTE_MBUF_F_RX_IP_CKSUM_xxx flags.

Inner IP checksum computation can also be enabled(per operation) by setting the flag RTE_MBUF_F_TX_IP_CKSUM in mbuf.

Defined at line 221 of file rte_security.h.

💜 uint32_t l4_csum_enable

Compute/verify inner packet L4 checksum in tunnel mode — layer 4 also gets the checksum treatment, no one left behind 💖

  • 1: For outbound, compute inner packet L4 checksum before tunnel encapsulation and for inbound, verify after tunnel decapsulation.
  • 0: Inner packet L4 checksum is not computed/verified.

The checksum verification status would be set in mbuf using RTE_MBUF_F_RX_L4_CKSUM_xxx flags.

Inner L4 checksum computation can also be enabled(per operation) by setting the flags RTE_MBUF_F_TX_TCP_CKSUM or RTE_MBUF_F_TX_SCTP_CKSUM or RTE_MBUF_F_TX_UDP_CKSUM or RTE_MBUF_F_TX_L4_MASK in mbuf.

Defined at line 237 of file rte_security.h.

💜 uint32_t ip_reassembly_en

Enable IP reassembly on inline inbound packets. — the "put it back together" feature 🧚

  • 1: Enable driver to try reassembly of encrypted IP packets for this SA, if supported by the driver. This feature will work only if user has successfully set IP reassembly config params using rte_eth_ip_reassembly_conf_set() for the inline Ethernet device. PMD need to register mbuf dynamic fields using rte_eth_ip_reassembly_dynfield_register() and security session creation would fail if dynfield is not registered successfully.
  • 0: Disable IP reassembly of packets (default).
Defined at line 250 of file rte_security.h.

💜 uint32_t ingress_oop

Enable out of place processing on inline inbound packets. — OOP, but like, the memory kind, not the programming kind 😭

  • 1: Enable driver to perform Out-of-place(OOP) processing for this inline inbound SA if supported by driver. PMD need to register mbuf dynamic field using rte_security_oop_dynfield_register() and security session creation would fail if dynfield is not registered successfully.
  • 0: Disable OOP processing for this session (default).
Defined at line 261 of file rte_security.h.

⭐ AUTHOR ⭐

Generated automatically by Doxygen for DPDK from the source code. not me being auto-generated 💀 the doxygen girlies ate with this one.

and that's the whole page bestie, slay 🎀 this was DPDK, Version 26.03.0, filed under rte_securi..._sa_options(3) — go forth and configure your SAs responsibly, mwah 💋✨

📦 where this page comes from